Vulnerability in Symantec Enterprise Firewall

CVE-2007-4422

The login interface in Symantec Enterprise Firewall 6.x, when a VPN with pre-shared key (PSK) authentication is enabled, generates different responses depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames.

EPSS: 0.026 (83.6th percentile) — read the EPSS interpretation.

Affected products

Symantec Enterprise_firewall — versions 6
N/a — versions n/a

References

cve@mitre.org (x_refsource_SECUNIA, third-party-advisory)
cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
cve@mitre.org (vdb-entry, x_refsource_BID)
cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
cve@mitre.org (x_refsource_OSVDB, vdb-entry)
cve@mitre.org (vdb-entry, x_refsource_XF)
cve@mitre.org (vdb-entry, x_refsource_VUPEN)